Key-Recovery Fault Injection Attack on the Classic McEliece KEM

Sabine Pircher; Johannes Geier; Julian Danner; Daniel Mueller-Gritschneder; Antonia Wachter-Zeh

doi:10.1007/978-3-031-29689-5_3

Key-Recovery Fault Injection Attack on the Classic McEliece KEM

Sabine Pircher, Johannes Geier, Julian Danner, Daniel Mueller-Gritschneder, Antonia Wachter-Zeh

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

We present a key-recovery fault injection attack on the Classic McEliece Key Encapsulation Mechanism (KEM). The fault injections target the error-locator polynomial of the Goppa code and the validity checks in the decryption algorithm, making a chosen ciphertext attack possible. Faulty decryption outputs are used to generate a system of polynomial equations in the secret support elements of the Goppa code. After solving the equations, we can determine a suitable Goppa polynomial and form an alternative secret key. To demonstrate the feasibility of the attack on hardware, we simulate the fault injections on virtual prototypes of two RISC-V cores at register-transfer level.

Original language	English
Title of host publication	Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers
Editors	Jean-Christophe Deneuville
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	37-61
Number of pages	25
ISBN (Print)	9783031296888
DOIs	https://doi.org/10.1007/978-3-031-29689-5_3
State	Published - 2023
Event	10th International Workshop on Code-Based Cryptography, CBCrypto 2022 - Trondheim, Norway Duration: 29 May 2022 → 30 May 2022

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	13839 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	10th International Workshop on Code-Based Cryptography, CBCrypto 2022
Country/Territory	Norway
City	Trondheim
Period	29/05/22 → 30/05/22

Keywords

Classic McEliece
Fault Attack
Key Encapsulation Mechanism
Key Recovery
Laser Fault Injections
Post-Quantum Cryptography

Access to Document

10.1007/978-3-031-29689-5_3

Cite this

Pircher, S., Geier, J., Danner, J., Mueller-Gritschneder, D., & Wachter-Zeh, A. (2023). Key-Recovery Fault Injection Attack on the Classic McEliece KEM. In J.-C. Deneuville (Ed.), Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers (pp. 37-61). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13839 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-29689-5_3

Pircher, Sabine ; Geier, Johannes ; Danner, Julian et al. / Key-Recovery Fault Injection Attack on the Classic McEliece KEM. Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers. editor / Jean-Christophe Deneuville. Springer Science and Business Media Deutschland GmbH, 2023. pp. 37-61 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{f608f0e4758c4b338d50a21a02f0cca8,

title = "Key-Recovery Fault Injection Attack on the Classic McEliece KEM",

abstract = "We present a key-recovery fault injection attack on the Classic McEliece Key Encapsulation Mechanism (KEM). The fault injections target the error-locator polynomial of the Goppa code and the validity checks in the decryption algorithm, making a chosen ciphertext attack possible. Faulty decryption outputs are used to generate a system of polynomial equations in the secret support elements of the Goppa code. After solving the equations, we can determine a suitable Goppa polynomial and form an alternative secret key. To demonstrate the feasibility of the attack on hardware, we simulate the fault injections on virtual prototypes of two RISC-V cores at register-transfer level.",

keywords = "Classic McEliece, Fault Attack, Key Encapsulation Mechanism, Key Recovery, Laser Fault Injections, Post-Quantum Cryptography",

author = "Sabine Pircher and Johannes Geier and Julian Danner and Daniel Mueller-Gritschneder and Antonia Wachter-Zeh",

note = "Publisher Copyright: {\textcopyright} 2023, The Author(s), under exclusive license to Springer Nature Switzerland AG.; 10th International Workshop on Code-Based Cryptography, CBCrypto 2022 ; Conference date: 29-05-2022 Through 30-05-2022",

year = "2023",

doi = "10.1007/978-3-031-29689-5_3",

language = "English",

isbn = "9783031296888",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "37--61",

editor = "Jean-Christophe Deneuville",

booktitle = "Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers",

}

Pircher, S, Geier, J, Danner, J, Mueller-Gritschneder, D & Wachter-Zeh, A 2023, Key-Recovery Fault Injection Attack on the Classic McEliece KEM. in J-C Deneuville (ed.), Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13839 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 37-61, 10th International Workshop on Code-Based Cryptography, CBCrypto 2022, Trondheim, Norway, 29/05/22. https://doi.org/10.1007/978-3-031-29689-5_3

Key-Recovery Fault Injection Attack on the Classic McEliece KEM. / Pircher, Sabine; Geier, Johannes; Danner, Julian et al.
Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers. ed. / Jean-Christophe Deneuville. Springer Science and Business Media Deutschland GmbH, 2023. p. 37-61 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13839 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Key-Recovery Fault Injection Attack on the Classic McEliece KEM

AU - Pircher, Sabine

AU - Geier, Johannes

AU - Danner, Julian

AU - Mueller-Gritschneder, Daniel

AU - Wachter-Zeh, Antonia

PY - 2023

Y1 - 2023

N2 - We present a key-recovery fault injection attack on the Classic McEliece Key Encapsulation Mechanism (KEM). The fault injections target the error-locator polynomial of the Goppa code and the validity checks in the decryption algorithm, making a chosen ciphertext attack possible. Faulty decryption outputs are used to generate a system of polynomial equations in the secret support elements of the Goppa code. After solving the equations, we can determine a suitable Goppa polynomial and form an alternative secret key. To demonstrate the feasibility of the attack on hardware, we simulate the fault injections on virtual prototypes of two RISC-V cores at register-transfer level.

AB - We present a key-recovery fault injection attack on the Classic McEliece Key Encapsulation Mechanism (KEM). The fault injections target the error-locator polynomial of the Goppa code and the validity checks in the decryption algorithm, making a chosen ciphertext attack possible. Faulty decryption outputs are used to generate a system of polynomial equations in the secret support elements of the Goppa code. After solving the equations, we can determine a suitable Goppa polynomial and form an alternative secret key. To demonstrate the feasibility of the attack on hardware, we simulate the fault injections on virtual prototypes of two RISC-V cores at register-transfer level.

KW - Classic McEliece

KW - Fault Attack

KW - Key Encapsulation Mechanism

KW - Key Recovery

KW - Laser Fault Injections

KW - Post-Quantum Cryptography

UR - http://www.scopus.com/inward/record.url?scp=85152530042&partnerID=8YFLogxK

U2 - 10.1007/978-3-031-29689-5_3

DO - 10.1007/978-3-031-29689-5_3

M3 - Conference contribution

AN - SCOPUS:85152530042

SN - 9783031296888

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 37

EP - 61

BT - Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers

A2 - Deneuville, Jean-Christophe

PB - Springer Science and Business Media Deutschland GmbH

T2 - 10th International Workshop on Code-Based Cryptography, CBCrypto 2022

Y2 - 29 May 2022 through 30 May 2022

ER -

Pircher S, Geier J, Danner J, Mueller-Gritschneder D , Wachter-Zeh A. Key-Recovery Fault Injection Attack on the Classic McEliece KEM. In Deneuville JC, editor, Code-Based Cryptography - 10th International Workshop, CBCrypto 2022, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2023. p. 37-61. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-031-29689-5_3